FBI Warns Against Medusa Ransomware Attacks

US government authorities have published a joint release warning the public about the Medusa ransomware-as-a-service (RaaS) operation, urging users to take preventive measures. Since its emergence in June 2021, the Medusa gang has impacted over 300 victims from a variety of sectors.

The March 12 joint release, signed by the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC), recommends steps to reduce risk. These include keeping software and firmware updated, implementing multifactor authentication on email and VPN services, and using long, complex passwords.

These agencies originally identified Medusa in June 2021, but attacks have ramped up in recent months. According to CISA, Medusa relies mostly on phishing campaigns to steal individuals’ and companies’ information. To do this, the group shares fraudulent links and emails that look similar to legitimate portals, tricking people into sharing their login information.

Phishing schemes are harder to defend against using traditional cybersecurity tools, making them appealing to hackers. Last year, a different group took over several Chrome extensions through an initial phishing attack.

Once Medusa acquires login credentials, it can access personally identifiable information (PII) from its victims, such as names, addresses, and banking information. The group employs a “double extortion” model, according to the agencies, where its members “encrypt victim data and threaten to publicly release exfiltrated data if a ransom is not paid.”

As a Ransomware-as-a-Service (RaaS) operation, Medusa offers its services for a fee through its online portal. This means anyone can launch attacks against specific targets, even without the technical skills hacking would normally require.

The report details a particularly egregious incident: “FBI investigations identified that after paying the ransom, one victim was contacted by a separate Medusa actor who claimed the negotiator had stolen the ransom amount already paid and requested half of the payment be made again to provide the ‘true decryptor’– potentially indicating a triple extortion scheme.”

The full report offers further mitigation actions to protect against the Medusa attacks.

There have been several high-profile ransomware attacks in the last few months, including an attack on the PowerSchool system that exposed the data of over 62 million students.